Browser Audit: How to Test Security, Leaks & Fingerprint
Browser Audit: How to Test Security, Leaks & Fingerprint
A browser audit is a systematic check of how your web browser handles security standards, privacy protections, and the data it exposes to websites. Every time you load a page, your browser sends dozens of signals: your IP address, installed fonts, screen resolution, timezone, TLS settings, and more. Some of these are necessary for the web to work. Others can be exploited to track you, fingerprint your device, or expose your real identity even when you think you are protected.
Running a browser audit helps you answer three questions: Is my browser implementing modern security features correctly? Am I leaking identifying information through DNS, WebRTC, or IP requests? And how unique does my browser fingerprint look to trackers?
This guide covers the main categories of browser testing, what each test reveals, and how to interpret the results.
What a Browser Audit Actually Tests
A complete browser audit spans several layers. Security-focused tools such as BrowserAudit run hundreds of automated checks against security standards like Content Security Policy, mixed content handling, and certificate validation. Privacy-focused tools such as Cover Your Tracks from the EFF measure how trackers see your browser. Suites like BrowserLeaks combine both approaches with granular leak tests.
Most audits fall into five categories:
- Security feature implementation – whether your browser correctly enforces standards that block common attacks
- IP and network leaks – whether your real IP address is exposed through DNS, WebRTC, or IPv6
- Browser fingerprinting – how unique your combination of browser and device characteristics is
- TLS and connection security – which protocols and cipher suites your browser negotiates
- Tracking protections – whether Do Not Track, Global Privacy Control, or content blockers are active
Security Feature Testing
Browser Audit: How to Test Security, Leaks & Fingerprint - Security Feature Testing.
Modern browsers ship with a long list of security controls: sandboxing, same-origin policy enforcement, certificate transparency, and protection against clickjacking, among others. When these features have bugs or are disabled, your browser becomes easier to attack.
BrowserAudit runs over 400 automated checks in this category. It verifies things like whether your browser blocks insecure mixed content, how it validates certificates, and whether it properly enforces Content Security Policy directives. The output is a pass/fail report you can use to compare browsers or report issues to browser vendors.
This type of audit is especially useful for IT teams that need to standardize browser configurations across an organization. A browser that fails multiple security checks on a corporate network is a liability, regardless of how fast it renders pages.
IP Address and Network Leak Tests
Browser Audit: How to Test Security, Leaks & Fingerprint - IP Address and Network Leak Tests.
Your IP address is the most direct identifier your browser exposes. If you use a VPN, proxy, or Tor, any leak of your real IP defeats the purpose of that tool.
DNS Leak Test
DNS requests translate domain names into IP addresses. If your browser sends DNS queries outside your VPN tunnel, your ISP can see which sites you visit. A DNS leak test checks whether your DNS resolver matches your VPN provider's resolver or falls back to your ISP's servers.
WebRTC Leak Test
WebRTC enables real-time communication in the browser, but it can also reveal your local and public IP addresses even when a VPN is active. The WebRTC API communicates with STUN servers to discover network paths, and those requests can bypass your VPN tunnel entirely. A WebRTC leak test attempts to trigger this behavior and reports whether your real IP is exposed.
IPv6 Leak Test
Many VPNs only tunnel IPv4 traffic. If your network has IPv6 connectivity and the VPN does not handle it, your browser may send IPv6 requests directly to the internet, exposing your real address. An IPv6 leak test checks for this gap.
BrowserScan offers a combined set of these checks. Its DNS and WebRTC leak tests verify whether your VPN is hiding your real IP, while its IP address lookup shows geolocation, ISP, and proxy detection details. Running these tests together gives you a clearer picture of your network exposure than any single check alone.
Browser Fingerprinting Tests
Browser Audit: How to Test Security, Leaks & Fingerprint - Browser Fingerprinting Tests.
Fingerprinting is the practice of combining many small browser characteristics into a unique identifier. Individually, your screen resolution or installed fonts are not identifying. Combined, they can make your browser one in millions.
Canvas Fingerprinting
Canvas fingerprinting draws a hidden image using the HTML5 Canvas API and measures the resulting pixels. Because rendering depends on your GPU, graphics driver, operating system, and browser, the output is surprisingly unique. A canvas fingerprint test shows you the hash that trackers would compute from your browser.
WebGL and GPU Fingerprinting
WebGL reports expose your graphics card vendor, renderer string, and supported extensions. This data adds another layer of uniqueness to your fingerprint. A WebGL report can reveal whether your browser is spoofing GPU information or leaking real hardware details.
Font Fingerprinting
Your installed font list is a powerful fingerprinting vector. By measuring text dimensions or enumerating available fonts, trackers can identify your system with high confidence. Font fingerprinting is difficult to spoof because blocking font enumeration can break legitimate sites.
Client Hints
Client Hints are HTTP headers that browsers send to servers, including device model, platform version, and architecture. They were designed to replace the User-Agent string but can also contribute to fingerprinting. A client hints analyzer shows exactly which hints your browser sends.
BrowserScan's fingerprint analysis tool combines several of these signals to verify whether your browser fingerprint looks authentic or suspicious. This is particularly relevant if you use anti-detect browsers or privacy extensions, because an inconsistent fingerprint can be more identifying than a consistent one. For a deeper look at how to verify anti-detect browser protection, see this guide on anti-detect browser testing.
TLS and Connection Fingerprinting
Your browser's TLS handshake reveals a lot: supported protocol versions, cipher suite order, extensions, and even the exact JA3 or JA4 fingerprint of your TLS client. This data lets servers identify your browser type and sometimes your specific browser version.
A TLS client test checks for weak protocols like SSLv3 or TLS 1.0, inspects your ClientHello message, and tests whether Encrypted Client Hello (ECH) is supported. If your browser negotiates outdated cipher suites, you are vulnerable to downgrade attacks. If your TLS fingerprint is unusual, you may stand out to bot detection systems.
Tracking Protection Checks
Some audits also verify whether your browser's tracking protections are active:
- Do Not Track (DNT) – a legacy header that requests sites not to track you; most sites ignore it
- Global Privacy Control (GPC) – a newer signal that carries legal weight in some jurisdictions
- Content blockers – whether ad blockers or privacy extensions are modifying page content
These checks help you understand what your browser is actually signaling to sites, rather than what you assume it is signaling.
How to Run a Complete Browser Audit
A practical audit workflow looks like this:
- Start with security standards. Run a tool like BrowserAudit to check core security feature implementation. Note any failures.
- Test for leaks. Run DNS, WebRTC, and IPv6 leak tests. If you use a VPN, run these tests with the VPN on and off to compare results.
- Check your fingerprint. Run canvas, WebGL, and font fingerprint tests. Note how unique your browser appears.
- Inspect TLS and connection data. Verify that your browser negotiates modern protocols and check your JA3/JA4 fingerprint.
- Review tracking signals. Confirm whether DNT, GPC, or content blockers are active and behaving as expected.
For a combined view of several of these checks in one place, BrowserScan's suite covers fingerprint analysis, DNS and WebRTC leak tests, IP lookup with proxy detection, port scanning, and user agent parsing without requiring any installation. The port scanner is especially useful for identifying open vulnerabilities on your network, while the user agent parser helps debug browser or bot strings.
Interpreting Audit Results
Not every warning is a problem. Some findings are expected behavior. Here is how to prioritize:
| Finding | Severity | What to do |
|---|---|---|
| WebRTC leaks real IP while VPN is on | High | Disable WebRTC or use a VPN with WebRTC leak protection |
| DNS requests go to ISP resolver while VPN is on | High | Configure VPN DNS settings or use encrypted DNS |
| Browser fails multiple security standard checks | High | Update browser or switch to a more secure one |
| Canvas fingerprint is highly unique | Medium | Use fingerprinting resistance features or accept the risk |
| TLS 1.0 or SSLv3 supported | Medium | Disable legacy protocols in browser settings |
| DNT header not sent | Low | Most sites ignore DNT anyway; consider GPC instead |
A highly unique fingerprint is not inherently dangerous, but it makes you easier to track across sites. If privacy is your goal, reducing uniqueness matters. If you are testing an anti-detect browser for multi-account workflows, consistency matters more than uniqueness.
Browser Audit vs. Network Security Audit
A browser audit focuses on the client side: what your browser exposes and how it implements security. A network security audit looks at your broader infrastructure: open ports, firewall rules, and service vulnerabilities.
These overlap in practice. An open port on your router can expose your browser traffic to interception. A browser that leaks DNS queries can undermine an otherwise secure network. For a broader view of online threats and how browser and network security fit together, see this guide on internet security testing.
Related reading
- IPWHOIS.io Pricing: Plans, Limits & What You Get - Compare IPWHOIS.io pricing plans from Free to Unlimited. See request limits, SLA terms, data fields, and how to choose the right IP geolocation tier.
- What Is an API? A Complete Guide to How APIs Work - Learn what an API is, how APIs work, the main types and protocols, real-world examples, security best practices, and how to test API-driven connections.
- Pixelscan.dev Setup: Browser Fingerprint & Bot Detection - Learn how to set up and use Pixelscan.dev for browser fingerprint analysis, bot detection, proxy checks, and DNS leak testing. Step-by-step guidance with practical examples.
Frequently Asked Questions
What is a browser audit?
A browser audit is a systematic evaluation of your web browser's security implementation, privacy protections, and data exposure. It typically includes tests for security feature compliance, IP and DNS leaks, browser fingerprinting, TLS configuration, and tracking protection signals.
How often should I run a browser audit?
Run a quick leak test whenever you change VPN providers, update your browser, or connect to a new network. Run a full audit quarterly or after major browser version updates, since security regressions can appear in new releases.
Can a browser audit detect malware?
No. Browser audits test security feature implementation and data exposure, not the presence of malware. If you suspect malware, use a dedicated antivirus or endpoint detection tool.
Do browser audit tools store my fingerprint?
Reputable tools state their data policies clearly. BrowserLeaks, for example, states that it does not collect personal data or store user fingerprints. Always check the privacy policy before running tests on any audit site.
What is the difference between a browser audit and a fingerprint check?
A fingerprint check is one component of a browser audit. A full audit also covers security standards, network leaks, TLS configuration, and tracking protections. A fingerprint check focuses specifically on how unique and consistent your browser's identifying characteristics are.
Can I pass a browser audit with a VPN?
A VPN helps with IP-related tests but does not automatically fix fingerprinting or security feature failures. You still need to check for WebRTC and DNS leaks and consider fingerprinting resistance separately.
Conclusion
A browser audit is not a one-time task. Browsers change, VPNs update, and tracking techniques evolve. Regular testing helps you catch leaks before they cause damage and understand exactly what your browser reveals to the sites you visit.
Start with the basics: run a security standards check, test for DNS and WebRTC leaks, and look at your fingerprint. If you use a VPN, test with it on and off. If you manage multiple browsers or use anti-detect tools, verify that each profile is consistent and leak-free. Tools like BrowserAudit, Cover Your Tracks, BrowserLeaks, and BrowserScan each cover different parts of this picture, and using them together gives you the most complete view of your browser's security and privacy posture.